Re:Sandboxing JavaScript Code
by bhelx on Thursday April 20, 2023 @01:30AM
(#35636741)
I've done this with Extism before. You can now write JavaScript plug-ins that run both on the server and the browser: https://github.com/extism/js-pdk
This uses QuickJS compiled to Wasm. You can also embed these into any of the host languages we support, python included. We do have some rudimentary support for HTTP requests as well.
In order to create a plug-in that allows the host to inject and run code, I've done this:
1. Create some kind of export function like `set_code` that takes the string input of the code in CJS format. Example:
```
function myFunc() {
return "hello world"
}
module.exports = myFunc
```
2. `set_code` can store that text into a plug-in variable with `Var.set('my-function', code)`
3. Create a second export function that can eval the code. Would look something like this:
```
let result = eval(Var.getString('my-function'))()
Host.outputString(result)
```
If you're interested I can compile one of these for you. I've been working on a demo that uses a similar technique.
In order to create a plug-in that allows the host to inject and run code, I've done this:
1. Create some kind of export function like `set_code` that takes the string input of the code in CJS format. Example:
``` function myFunc() { return "hello world" }
module.exports = myFunc ```
2. `set_code` can store that text into a plug-in variable with `Var.set('my-function', code)`
3. Create a second export function that can eval the code. Would look something like this:
``` let result = eval(Var.getString('my-function'))() Host.outputString(result) ```
If you're interested I can compile one of these for you. I've been working on a demo that uses a similar technique.
update: fixed some bad javascript